Who Owns Your Website? Domain, Data, Logins, Handover

A renewal notice goes to the wrong inbox

Consider a three-doctor clinic in Jodhpur. This is an illustration, not a report about a real clinic. In 2022 a freelance designer builds its website and, as a favour, registers the .in domain himself, with his own Gmail as the contact address and the clinic’s name on the invoice. Three years on, he has changed jobs and rarely opens that inbox. The registrar’s renewal notices go there.

Email is the usual way registrars reach a registrant, and the .IN registry warns that if a registrant cannot be reached by email, the domain may expire without their knowledge. Say the registration lapses on a Sunday. How long the registrar waits before asking the registry to delete it is the registrar’s own policy. Once a delete request is made, the .IN registry puts the name into a 30-day redemption period and removes it from the zone file, so the website and any email on that domain stop working. If nobody asks the registrar to restore it, five more days pass and the previous registrant can no longer restore it. After that, anyone can register the name.

Nobody in that story is a villain. The clinic simply never owned the domain in the sense that matters. It paid for it and used it every day, while the registrar’s record named someone else. Appointment confirmations bounce, the Google listing points to a dead address, and the fix depends on a man who has stopped answering.

Owning a website is not a feeling and not an invoice. It is a short list of names in records that other organisations keep. This article goes through those records one by one, gives you a checklist you can run in an afternoon, and then describes how a Dwize handover works if you ever leave. The checklist is useful whoever your vendor is.

The domain and the DNS

The registrant is the owner of a domain. ICANN’s registrant rights and responsibilities, which apply to generic domains such as .com, say that whoever is listed as the Registered Name Holder is the holder of record and must keep the contact details accurate. They even use the case of a website designer registering a domain for a client, where the designer, as the person listed, stays the holder. For .IN, the registry’s FAQ for registrants says the same thing in practical terms: keep the registrar’s email address current, check the details twice a year, and know that the auth code you need to transfer the domain comes from your registrar, which is contractually required to provide it when the registrant asks. NIXI itself does not hand auth codes to registrants.

Two small steps follow. First, find out today which registrar holds your domain and log in. Second, ask the registrar to set the update-prohibited and transfer-prohibited statuses, which the registry suggests, so the domain can only change when you mean it to. If you have never logged in, assume someone else is the registrant until you have checked.

DNS is the second layer. Its records decide where your website, your email and your verification codes point, so whoever can edit DNS can switch your site off or redirect your mail. Dwize’s published wording is a buyer-owned domain with Dwize-managed records: your domain, your DNS, and nothing held in a way you cannot leave. Read plainly, that is Dwize managing the records while the registration stays yours. Keep a copy of the record list somewhere you can find it.

One caveat on the Dwize side. Dwize Go lives at a Dwize-managed subdomain, yourname.dwize.in, so that address cannot travel with you. The pricing page lists a custom-domain add-on at ₹2,499 a year, and Dwize registers that domain in your business’s own name, so the registrant field carries your name, not ours.

Google accounts: Business Profile, Search Console, Analytics

These three are where a local business’s visibility lives, and all three have named roles.

A Google Business Profile can have many owners but only one primary owner. Only owners can add or remove users, and managers can do nearly everything else but not that. Only the primary owner can transfer primary ownership, which Google recommends when a business changes hands so that reviews are kept. A new owner or manager also has to wait 7 days before managing some features. The safe arrangement is simple: you as primary owner, your vendor as a manager. The reverse arrangement leaves you dependent on the vendor’s goodwill, because only the primary owner can hand that role over.

Search Console has a quieter trap. According to Google’s permissions page, a property must have at least one verified owner, or no users have access. If the last verified owner is removed, everyone else loses access after a grace period, and data keeps collecting with nobody able to see it until someone verifies the site again. Verification is often done with a file or tag the vendor placed on the site, and a rebuild can delete that file. The defence is to be a verified owner yourself, ideally with a DNS record, and to keep a second verified owner.

In Google Analytics, the Administrator role gives full control and the ability to manage users. Make sure your own Google account is an administrator at the account level.

App stores, payments and customer data

For a native app, the Apple Developer account and the Google Play Console account are the equivalent of the domain. For an organisation account, Apple’s Account Holder renews the membership, accepts legal agreements and approves banking changes. Apps can be moved between accounts, but the Account Holder must start the transfer and the receiving Account Holder must accept it, and Apple’s transfer rules include conditions such as an app-specific shared secret for subscriptions and a bundle ID that cannot change. Google Play’s transfer process moves users, ratings and reviews but not payout or earnings reports. Both work. Neither is something you want to learn in a dispute. Dwize’s published standard is that the buyer owns the developer accounts, with the fees billed at cost.

Payments follow the same logic. A Dwize Store takes UPI, cards, netbanking and cash on delivery through accounts the buyer owns. What matters is that the gateway dashboard is in your business’s name and that settlements land in your own bank account.

Customer data is the last record, and it now has a legal frame. The government’s explainer on the DPDP Rules, notified in the Gazette on 13 November 2025, defines a Data Fiduciary as the entity that decides why and how personal data is processed, and a Data Processor as one that processes it on the fiduciary’s behalf. If your website form collects a patient’s phone number, you are the fiduciary and the vendor or host is the processor. The Rules set an eighteen-month phase-in, and individuals can ask to access, correct or remove their data, with a response due within ninety days. That is hard to honour if the data sits in a system only a departed freelancer can open. This is general information, not legal advice.

The ownership checklist

Run this once, with your phone beside you. Every row is a five-minute test, and the whole list is usually an afternoon. Anything you cannot do yourself is a finding.

If every row passes and your vendor answers messages within a day, there is nothing to change. If three or more fail, fix the domain first, because it is the one that fails loudly and takes the others with it.

How a Dwize handover works

Covenant 08 is the contract line: brand, domain, content, customer data and agreed exports remain portable at year-end. The operating standards ledger turns it into a measurable commitment. If you do not renew, content, data, DNS instructions, deployment guidance and the agreed export artifacts ship before Day 365. The threshold is 100 percent delivered before Day 365, and if timing changes, Dwize writes a handover plan.

Two details change how you should use it. The word agreed means the list of exports is something you settle on paper, so ask to see it while the file is new. Second, the renewal preview arrives on Day 305, sixty days before the year ends. Treat those sixty days as a rehearsal: ask for the export list, ask for one sample export of the content and one of the customer data, and open them. A handover you have tested is worth more than one you have been promised. The Care Year page describes the full year, and the trust page gives the company’s verifiable identity.

If you are coming from a vendor-held WordPress or Shopify setup, the migration page explains how Dwize handles moves in. The same checklist applies before you start: collect your own logins first, so the move does not depend on the old vendor’s cooperation.

What no lock-in does not mean

No lock-in does not mean no switching cost. Exports are data. Someone still has to host the next version, rebuild the design if you want it, and re-point the domain. A static Site is the easy case, because the pages are files. A store with order history, customers and GST invoices is a bigger job, and you should ask what formats it exports before you rely on it.

It also does not mean Dwize runs your site after the Care Year ends. If you do not renew, the care ends. The ledger commits to shipping the handover artifacts before Day 365, but it does not publish a rule for the days after, so ask in writing what happens to the live site between Day 365 and the day your new host takes over. Decide who will watch the certificate and the domain in that gap.

And it does not make the checklist optional. The best case is a Care Year that ends because you chose to move, with every row above already green.